New Delhi: An Israeli advertising company, Discover-Tech, helped deliver spyware through online adverts that could compromise selected devices without users clicking anything, researchers have reported. The findings connect the company’s advertising infrastructure to attacks on Qatar-based broadcaster Al Jazeera, exposing how commercial ad networks can become a route for covert surveillance.
The University of Toronto’s Citizen Lab published its investigation into the technique, named AdFection, on Thursday, alongside research by the advertising security company Confiant. Citizen Lab described it as the first public technical confirmation of mercenary spyware being delivered through targeted advertising without any interaction from the victim.
Discover-Tech presents itself as a digital advertising business, but researchers said its Controlium platform also connects surveillance vendors to the advertising market. They linked attacks involving at least 45 Al Jazeera devices in 2024 and 2025 to spyware from Candiru, an Israeli-founded company now operating under the name Integrity Labs.
The researchers examined network logs supplied by Al Jazeera and identified a sequence in which affected devices contacted Discover-Tech infrastructure, followed by Candiru servers used to assess targets and subsequently communicate with infected machines. The findings establish a connection between the advertising delivery system and the spyware operation, although the government customer or customers behind the attacks remain unidentified.
The mechanism exploits an important feature of online advertising: an advert can carry executable code as well as an image or video. In an automated auction, advertisers compete to reach a user based on information about the device, browsing context and advertising identifiers, creating opportunities to select individuals with considerable precision.
Confiant’s parallel investigation traced an apparently ordinary advertising banner into a concealed chain of scripts associated with Candiru infrastructure. It found sophisticated device profiling and a covert communications channel through which the operator could issue further instructions, while the visible advert gave users little reason to suspect surveillance.
This selective behaviour helps explain why such operations can evade scrutiny: different visitors encountering the same advertising infrastructure need not receive the same code. Confiant estimated that Discover-Tech served roughly 10 million advertising impressions daily, feeding a collection of device fingerprints, internet addresses and advertising identifiers from which individual targets could be selected.
The scale of advertising exposure should, however, be distinguished from the number of successful spyware infections. An advert appearing on a device or institutional network does not, by itself, establish that the device was compromised.
According to Reuters, Discover-Tech’s adverts reached more than 120,000 websites and 75,000 apps. Researchers also identified exposure within sensitive networks, including the Pentagon, the UN, Nato, the International Criminal Court and the International Atomic Energy Agency, without establishing successful infections across those organizations.
The spyware involved is capable of extensive intrusion once installed. An earlier Citizen Lab investigation into Candiru documented capabilities including stealing files, passwords and browser data, extracting communications, capturing screenshots and activating a target’s microphone or webcam.
The findings have parallels with Pegasus, the surveillance software developed by another Israeli company, NSO Group, whose deployment has repeatedly drawn scrutiny over attacks on civil society. Pegasus has used zero-click exploits that compromise devices through software processing incoming content automatically, removing the need to persuade a victim to open a malicious link.
In September 2021, Citizen Lab disclosed ForcedEntry, an iMessage exploit discovered while examining a Saudi activist’s Pegasus-infected phone. Malicious files exploited Apple’s image-processing software, allowing infection without the user opening them; Apple subsequently issued a security update.
Another Pegasus exploit chain, BlastPass, disclosed in September 2023, could compromise iPhones running the then-current iOS 16.6 through malicious images in iMessage attachments. Apple patched the vulnerabilities, and its security team confirmed that Lockdown Mode blocked that particular attack.
The distinction in the latest investigation is the delivery route: advertising infrastructure provided access to selected targets during ordinary browsing or app use. Citizen Lab attributed the documented Al Jazeera attacks to Candiru, rather than Pegasus or NSO Group.
Google has removed Discover-Tech from its advertising platforms, IAB Europe has suspended its approved-vendor status, and Comcast-owned Beeswax has also removed the company. Discover-Tech did not immediately respond to media requests for comment, while Reuters said its attempts to reach Candiru’s owners were unsuccessful.